CVE-2024-1852 WP-Members Membership Plugin <= 3.4.9.2 - Unauthenticated Stored Cross-Site Scripting

The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the X-Forwarded-For header in all versions up to, and including, 3.4.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

BizCalendar Web <= 1.1.0.19 - Reflected Cross-Site Scripting via 'tab'

Description The BizCalendar Web plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 1.1.0.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2024-0837

Technical details beyond the initial description are not provided in the attached documents. Monitor for updates to confirm affected versions, impact, and fixes.

CVE-2024-2471

The FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image attachment fields such as 'Title', 'Alt Text', 'Custom URL', 'Custom Class', and 'Override Type' in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This...

CVE-2024-2868

CVE-2024-2868 affects the ShopLentor (WooCommerce Builder) WordPress plugin. The vulnerability is stored XSS via the slitems parameter in the WL Special Day Offer Widget, present in all versions up to 2.8.3 due to insufficient input sanitization and output escaping. Exploitation requires authenti...

CVE-2024-3162

The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Testimonial Widget Attributes in all versions up to, and including, 2.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributo...

CVE-2024-1327 Jeg Elementor Kit <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Box

The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's image box widget in all versions up to, and including, 2.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-lev...

CVE-2024-1327

CVE-2024-1327 affects the Jeg Elementor Kit WordPress plugin. It allows Stored XSS via the Image Box widget in all versions up to 2.6.3 due to inadequate input sanitization and output escaping. Exploitation requires contributor-level authentication (or higher); the script executes when a user loa...

Convert Post Types <= 1.4 - Reflected Cross-Site Scripting

Description The Convert Post Types plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...

Kanban Boards for WordPress <= 2.5.21 - Reflected Cross-Site Scripting

Description The Kanban Boards for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.5.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...

Spiffy Calendar < 4.9.10 - Reflected Cross-Site Scripting

Description The Spiffy Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in page...

Jobeleon Theme < 1.9.2 - Reflected Cross-Site Scripting

Description The Jobeleon WPJobBoard theme for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.9.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

Booking Activities < 1.15.20 - Reflected Cross-Site Scripting

Description The Booking Activities plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.15.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVE-2024-2924 Creative Addons for Elementor <= 1.5.12 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Creative Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 1.5.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

Forminator < 1.29.1 - Unauthenticated Stored XSS

Description The plugin is vulnerable to Stored Cross-Site Scripting via an uploaded file e.g. 3gpp file due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user...

SEO Plugin by Squirrly SEO < 12.3.17 - Reflected Cross-Site Scripting

Description The plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an...

PropertyHive < 2.0.9 - Reflected Cross-Site Scripting

Description The PropertyHive plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...

Shipping with Venipak for WooCommerce < 1.19.6 - Reflected Cross-Site Scripting via 'venipak_labels_link'

Description The Shipping with Venipak for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'venipaklabelslink' parameter in versions up to, and including, 1.19.5 due to insufficient input sanitization and output escaping. This makes it possible for...

Sunshine Photo Cart < 3.1.2 - Reflected Cross-Site Scripting

Description The Sunshine Photo Cart plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in page...

Photo Gallery by Ays < 5.5.3 - Reflected Cross-Site Scripting

Description The Photo Gallery by Ays plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 5.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...